workflow: Only publish proper releases to PyPI

Match the tag name against the release only sematic versioning regex
for the PyPI upload build step.

Signed-off-by: Daniel Wagner <[email protected]>

Author: dwsuse

.github/workflows/python-publish.yml

@@ -46,13 +46,21 @@ jobs:
     runs-on: ubuntu-latest
     if: startsWith(github.ref, 'refs/tags/v')
     steps:
-      - uses: actions/download-artifact@v3
+      - name: Check if it is a release tag
+        id: check-tag
+        run: |
+           if [[ ${{ github.event.ref }} =~ ^refs/tags/v([0-9]+\.[0-9]+)(-rc[0-9]+)?$ ]]; then
+               echo ::set-output name=match::true
+           fi
+      - name: Download artifiact
+        uses: actions/download-artifact@v3
+        if: steps.check-tag.outputs.match == 'true'
         with:
           name: artifact
           path: dist
-
       - name: Publish package to PyPI
         uses: pypa/gh-action-pypi-publish@release/v1.5
+        if: steps.check-tag.outputs.match == 'true'
         with:
           user: __token__
           password: ${{ secrets.PYPI_API_TOKEN }}